CHIEF OF DETECTIVES 


NOTICE 

8.6 


April 27, 2018 


TO: All Concerned Personnel 

FROM: Chief of Detectives 

SUBJECT: PROCEDURES FOR THE PRESERVATION OF SOCIAL MEDIA 
ACCOUNTS FOR INVESTIGATIVE PURPOSES 


In today’s connected society, it is increasingly common for suspects, victims, and witnesses to 
have digital evidence stored on social media services and other internet-enabled accounts. 
Because this information may disappear before, during, or after a crime for a variety of reasons, 
it is vital that officers preserve the accounts as soon as possible during their preliminary 
investigation. This will enable detectives to obtain search warrants for the accounts before any 
pertinent information is lost. 

California Penal Code (PC) Section 1524.3(g) states that “a provider of wire or electronic 
communication services or a remote computing service, upon the request of a peace officer, shall 
take all necessary steps to preserve records and other evidence in its possession pending the 
issuance of a search warrant or a request in writing and an affidavit declaring an intent to file a 
warrant to the provider. Records shall be retained for a period of 90 days, which shall be 
extended for an additional 90-day period upon a renewed request by the peace officer.” This 
process is sometimes referred to as submitting a “preservation letter,” or “preservation request.” 
This Notice defines procedures for submitting preservation requests to service providers. 

PROCEDURES: 

I. OFFICER’S RESPONSIBILITIES: 

Officers who discover the presence of relevant so'cial media accounts in the course 
and scope of their preliminary investigation shall document the full account 
information and the name of the service or application in the narrative of their 
Investigative Report (IR). Account information may include true names, 
monikers/AKAs, usernames, email addresses, and full website links. Printed copies of 
web pages may also be attached. 

Officers shall not login to any personal accounts to view content related to any 
investigation, This may inadvertently connect personal accounts to those of suspects, 
victims, or witnesses, or otherwise compromise sensitive investigations. Officers may 
refer to the Department’s Social Media User Guide (2015) for additional 
recommendations regarding social media investigations. 
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Officers shall attempt to submit a preservation request for the accounts that have 
potential digital evidence. As of this writing, the largest social media service provider 
is Facebook, Inc./Instagram, LLC. These services have a law enforcement web portal 
that is a convenient way to quickly submit preservation requests. The portal is located 
at: www.facebook.com/records. 

Officers may request access to login to the portal using their Department email 
address. Once officers receive a confirmation link via e mail, they may click the 
temporary link and will have access to the system. Officers will then need to click 
“Preservation Request, provide an Incident or DR number, insert the link to the 
account and a date, and submit the request. An email confirmation will follow. 

NOTE: It is extremely important to ensure that the spelling of the account 
information is accurate, otherwise service providers will not comply with any request 
Officers shall note the date and time that a preservation request was completed inside 
the narrative of their IR. 

Other social media services, such as Twitter and Snapchat, have different procedures 
for preservation requests. If officers encounter these services, they shaft consult with 
a detective, if available. If a preservation request cannot be submitted at the time the 
IR is completed, this shall be noted in the narrative. 

II. WATCH COMMANDER’S RESPONSIBILITIES: 

When reviewing any crime or arrest report involving digital social media evidence, 
Watch Commanders shall ensure that a preservation request was submitted and 
documented appropriately within the IR. If no preservation request was made, Watch 
Commanders shall also ensure that this is documented accordingly. 

HI. AREA AND SPECIALIZED DETECTIVES’ RESPONSIBILIES: 

Area and specialized detectives shall verify that preservation requests were submitted 
by officers as directed. Detectives should document any additional preservation 
requests or related search warrants in their Follow-up Investigation Report Form 
03.14.00. 

Area and specialized detectives may be called upon to research the procedures for 
submitting preservation requests to other service providers. Detectives may refer to 
the www.search.org, Internet Service Provider (ISP) list, for contact information. 
Detectives may also search online for the name of the service provider and the phrase 
“law enforcement.” 
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Should you have any questions regarding this Notice, please contact Detective Bureau, 
at (213) 486-7000. ^ 


APPROVED: 



SEAN W. MALINOWSKI, Deputy Chief 
Chief of Staff 

Office of the Chief of Police 
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